Analysis

  • max time kernel
    142s
  • max time network
    159s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-01-2023 21:57

General

  • Target

    9d4fef68cea3a9741e7ec17df630c91ec8be60764c9794dbf4c0c0b15c72866b.exe

  • Size

    64KB

  • MD5

    50fcbd0927ae25c74e818cf3a2e39abd

  • SHA1

    13652b28506e98577505a34ef21e8ef0073d0ad1

  • SHA256

    9d4fef68cea3a9741e7ec17df630c91ec8be60764c9794dbf4c0c0b15c72866b

  • SHA512

    4cabfaf9ef0155e435fd4f9fdf4471810eb635d17fd7aa2fb5a899978c42e9603b30126fe9b1aadde5c192ab477db590c33d59fdf624217455561891f06547f9

  • SSDEEP

    768:hX76pMOAudWfklC3wbiypeqPGS4pLP4pexKWkRRVXlcxE9qms:B70P1DjeqL4uexngRVpA

Score
10/10

Malware Config

Extracted

Family

guloader

C2

https://cagno-di.com/wp-admin/bin_lUQUaSkho34.bin

http://103.141.138.118/bin_lUQUaSkho34.bin

xor.base64

Signatures

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9d4fef68cea3a9741e7ec17df630c91ec8be60764c9794dbf4c0c0b15c72866b.exe
    "C:\Users\Admin\AppData\Local\Temp\9d4fef68cea3a9741e7ec17df630c91ec8be60764c9794dbf4c0c0b15c72866b.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1476

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1476-134-0x0000000002120000-0x0000000002129000-memory.dmp
    Filesize

    36KB

  • memory/1476-135-0x00007FFA61F90000-0x00007FFA62185000-memory.dmp
    Filesize

    2.0MB